Systems Engineering at MITRE CLOUD COMPUTING SERIES Products to Build a Private Cloud Lawrence Pizette Geoffrey Raines July 2010 Executive Summary “With today’s virtual infrastructure solutions and a Federal information technology (IT) leaders who are growing list of internal cloud platform technologies, seeking to leverage cloud computing concepts while it’s fairly easy for an enterprise to start up a cloud- maintaining full control and ownership of their IT like environment within its own domain.” capability may elect to implement a private cloud computing environment. A private cloud capability – James Staten et al., Deliver Cloud Benefits Inside Your Walls, Forrester Research, April 13, 2009 can offer increased security and provide the flex- ibility to implement unique requirements along with the benefits and attributes of ownership, including that they list are on-demand self-service, broad net- data rights and control over the system. Some of work access, resource pooling (e.g., multi-tenancy), the benefits of using a private cloud approach over rapid elasticity (e.g., rapid scaling), and measured traditional IT are: it allows for better utilization of service. As aspects of these characteristics are pres- hardware, the ability to easily provide continuity of ent in other IT approaches, it is the combination that operations (COOP), the ability to quickly provision describes cloud computing. capabilities, and the ability to provide location inde- pendent access. Organizations that pursue develop- Categories of Infrastructure for a Private Cloud— ment of a private cloud infrastructure are investing The product categories listed below were selected their own capital with commensurate development based upon a generalization of the private cloud schedules, risks, and operating costs. They are trad- computing marketplace and available technologies. ing off the attributes of a private cloud for a differ- However, industry innovation is not constrained to ent set of benefits and risks that they might attain if neat categories; some vendors are offering suites of they chose a different cloud computing deployment capabilities that span multiple categories. model. In order to help these leaders to understand the private cloud computing products available in • Virtualization technology provides the hypervi- early 2010 and how they may fit into their data cen- sor software, which allows multiple instances of ters, this paper surveys the private cloud computing “guest” operating systems to run concurrently on market. the same physical server. This capability enables “multi-tenancy,” which is the sharing of physical While the benefits of a private cloud may be numer- resources providing for better server utilization. ous, shared community or public cloud offerings The improved server utilization can reduce heat- may be available sooner at lower costs, but will likely ing, ventilation, and air conditioning (HVAC) offer a different set of attributes for mission assur- and electric costs, data center, size and other ance and other important characteristics. related infrastructure costs. It also can allow advanced users or data center operators to provi- Attributes of Cloud—While there is no single sion capabilities quickly, facilitating scalability, agreed upon definition for cloud computing, the self-service provisioning, and COOP. National Institute for Standards and Technology • Storage technology, such as disk arrays, storage (NIST) has listed several essential characteristics of a area networks (SANs), and storage connection private cloud approach.1 The essential characteristics Executive Summary—Products to Build a Private Cloud i technologies can provide the underlying persis- employed that considers the Federal IT leader’s tent storage for a private cloud. The market for high-level objectives and specific requirements. these types of systems is huge: In Q4 2009, the While some private clouds may be driven by worldwide external disk systems market was the desire to reduce costs, others may be driven $5.288 billion with the top five vendors, EMC, primarily by new capabilities that can be pro- IBM, HP, NetApp, and Dell taking 69 percent of vided. Additionally, there can be many specific the market share.2 Regardless of which vendor requirements in a private cloud such as perfor- provides it, storage is essential to a private cloud mance, self-service provisioning, COOP, location as it can enable burst capacity and provide capa- independent access, and robust security, which bilities to facilitate COOP and location indepen- need to be considered carefully before acquiring dent access. specific hardware and software products. • Security capabilities for a private cloud are • Security should be considered from the begin- essential. Products offered to the private cloud ning of the structured systems engineering computing market provide capabilities such process. Security architects should perform an as identity management, logging and audit- analysis and consider a pilot to understand new ing, anti-malware software, intrusion detection threats and mitigating strategies. The analysis systems (IDS) and intrusion prevention systems should consider how private cloud capabilities (IPS), and firewall capabilities between virtual would be integrated into the rest of the data machines. While there are many products on center’s environment (e.g., identity management the market, addressing security concerns within systems). multi-tenant, cloud computing environments is • A private cloud will require updated management an active area for research for many organiza- and governance. For example, if virtual environ- tions. Therefore, products will continue to evolve ments are not managed, the absence of controls as more knowledge is learned about threats and coupled with the relative ease of creating virtual measures to mitigate them. machines can result in a proliferation of environ- • Provisioning, management, and metering tools ments and a condition informally known as “VM are key to providing Federal IT leaders and users sprawl.” This condition can offset anticipated with many of the advantages a private cloud can efficiency gains and allow for security exposures offer: self-service provisioning, burst capability, due to unmaintained environments. In order to service-level agreement (SLA) compliance, and, if mitigate the risk, piloting and testing of the inte- needed, metering for “pay as you go” functional- grated environment should be considered as part ity. Tools in this category provide the ability to of the overall systems engineering plan. monitor server utilization, system resources, and A private cloud implementation can offer signifi- other operational attributes. The ability to provi- cant benefit to Federal organizations seeking to sion environments on-demand, independent of realize some of the benefits of cloud computing the underlying hardware enables the ability to while maximizing control over their environment. scale environments in near real time and, if nec- Recognizing that the benefits coupled with control essary, to instantiate environments in a different can be compelling for many Government organi- location. zations, industry has provided a wide selection of Considerations— products for realizing the vision. This paper pro- • When developing a private cloud, a compre- vides insight into example products and consider- hensive systems engineering process should be ations for their use. ii Cloud Computing Table of Contents 1.0 Introduction to Products to Build a Private Cloud 1 2.0 Virtualization and Hypervisors 2 3.0 Storage Solutions 4 4.0 Security Products 6 5.0 Provisioning, Management, and Metering 8 Appendix A—Products Mentioned 11 References 12 THE BIG PICTURE: A private cloud computing environment can offer a path forward for Federal IT leaders seeking to realize some of the benefits of cloud computing while maximizing control over their environment. Lawrence Pizette Products to Build a Private Cloud Geoffrey Raines 1.0 Introduction to Private Clouds “Companies that want the benefits of cloud computing Summary—For Federal information technology services without the risks are looking to create cloud-like (IT) leaders considering employing a private cloud environments in their own data centers. To do it, they’ll approach, this paper provides a window into prod- need to add a layer of new technologies—virtualization ucts that are available from the commercial mar- ketplace. The paper is organized into the general management, cloud APIs, self-service portals, categories of virtualization and hypervisors, storage chargeback systems, and more— (e.g., storage area networks, storage arrays), security, to existing data center systems and processes.” and provisioning, management, and metering. The – Charles Babcock, Information Week, April 11, 2009 product categories in this paper were selected based upon a generalization of the private cloud computing marketplace and the technologies available in early computing: private, community, public, and hybrid.3 2010. However, vendor products do not always fall According to the NIST definition: directly within one category; some vendors are offer- ing suites of capabilities that span multiple categories • Private clouds are “operated solely for an and other vendors are offering appliances, some of organization.” which package both hardware and software into “a • Community cloud “infrastructure is shared by cloud in a box.” Similarly, other vendors are offering several organizations